版本：ELK 8.0.1

一、安装elasticsearch:8.0.1

https://hub.docker.com/_/elasticsearch
docker pull elasticsearch:8.0.1
docker images
docker network create elknetwork #创建自定义的网络(用于连接到连接到同一网络的其他服务
docker run -d --name elasticsearch --net elknetwork -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" elasticsearch:8.0.1

172.18.0.2:9200
docker exec -it elasticsearch /bin/bash

###自动生成密码用auto， 自己设置用 interactive
[root@elk logstash]# docker exec -it elasticsearch /bin/bash
elasticsearch@7e7e9cbb1e01:~$ ./bin/elasticsearch-setup-passwords auto
******************************************************************************
Note: The 'elasticsearch-setup-passwords' tool has been deprecated. This command will be removed in a future release.
******************************************************************************

Initiating the setup of passwords for reserved users elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitoring_user.
The passwords will be randomly generated and printed to the console.
Please confirm that you would like to continue [y/N]y



Changed password for user apm_system
PASSWORD apm_system = fuLgmI0kEIhaVIdk3gPL

Changed password for user kibana_system
PASSWORD kibana_system = 5gVgnzMFqOiXt810iqjw

Changed password for user kibana
PASSWORD kibana = 5gVgnzMFqOiXt810iqjw

Changed password for user logstash_system
PASSWORD logstash_system = rX2rl3fhXBkO02KZ59pW

Changed password for user beats_system
PASSWORD beats_system = u4ZDiEIiR17beOeqQwHM

Changed password for user remote_monitoring_user
PASSWORD remote_monitoring_user = 892goPXvQnS6nqhL3h2Q

Changed password for user elastic
PASSWORD elastic = zLYQn7bx7FfkKPJfPMzf

#####证书配置，可忽略（8.0.1 已默认自动开启）
./bin/elasticsearch-certutil ca
./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12

###为kibana生成tocken,配置kibana需要使用
elasticsearch@9eaef9042bf6:~$ ./bin/elasticsearch-create-enrollment-token --scope kibana
WARNING: Owner of file [/usr/share/elasticsearch/config/users] used to be [root], but now is [elasticsearch]
WARNING: Owner of file [/usr/share/elasticsearch/config/users_roles] used to be [root], but now is [elasticsearch]
eyJ2ZXIiOiI4LjAuMSIsImFkciI6WyIxNzIuMTguMC4yOjkyMDAiXSwiZmdyIjoiMjFiZTM3YWNhNTM2YjFjNTI4YjI2OTJjOTc0ZGQ2YjI4ZDI0ODhhOTlmOWYxMWRhNjI4MjAyN2M2OWQwNjFlYiIsImtleSI6IlVuQ1VISUFCVzBWS2QxTGJIY3ZMOlpLUmVfYkdLVEhDbXZ4UUxZQzM4ZmcifQ==

二、安装 kibana:8.0.1

https://hub.docker.com/_/kibana
docker pull kibana:8.0.1
docker images
docker run -d --name kibana --net elknetwork -p 5601:5601 kibana:8.0.1
http://ip:5601

三、安装 logstash:8.0.1

https://hub.docker.com/_/logstash
docker pull logstash:8.0.1
docker images

创建 logstash 目录，用来存放所有配置,创建log存放日志目录
mkdir /data/logstash/conf.d -p
mkdir /data/log/logstash

vim /data/logstash/logstash.yml
path.config: /usr/share/logstash/conf.d/*.conf
path.logs: /var/log/logstash

vim /data/logstash/conf.d/opscloud.conf  ##（数据导入到redis中 ，预设 下文redis里设置相关）
input{
redis {
host => "10.2.33.100"
port => 8379
password => "Re123dis"
key => "nginx-web"
data_type => "list"
db => 4
}
}
output {
elasticsearch {
hosts => ["https://elastic:zLYQn7bx7FfkKPJfPMzf@172.18.0.2:9200"]
index => "redis-%{+YYYY.MM.dd}"
ssl => true
ssl_certificate_verification => false
}
stdout { codec => rubydebug }
}


docker run -it -d -p 5044:5044 --name logstash --net elknetwork -v /data/logstash/logstash.yml:/usr/share/logstash/config/logstash.yml -v /data/logstash/conf.d/:/usr/share/logstash/conf.d/ --privileged=true logstash:8.0.1

访问配置kibana

docker exec -it kibana /bin/bash
kibana@c36aaf08016b:~$ ./bin/kibana-verification-code
Your verification code is: 286 122 

 四、安装 redis

docker pull redis
wget http://download.redis.io/redis-stable/redis.conf
####修改的配置文件内容
appendonly yes 开启redis 持久化
protected-mode no
requirepass Re123dis
######
sudo docker run -p 8379:6379 --name redis -v /data/redis/redis.conf:/etc/redis/redis.conf -v /data/redis/data:/data -d redis --appendonly yes

五、客户端上安装 filebeat

yum -y install filebeat.x86_64

[root@www filebeat]# cat /etc/filebeat/filebeat.yml
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/httpd/*_log
  tags: ["nginx-web"]
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 1
setup.kibana:
output.redis:
  hosts: ["10.2.33.100:8379"]
  password: "Re123dis"
  key: "nginx-web"
  data_type: "list"
  db: 4
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

[root@www filebeat]# systemctl start filebeat
[root@www filebeat]# systemctl status filebeat
● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
   Loaded: loaded (/usr/lib/systemd/system/filebeat.service; disabled; vendor preset: disabled)
   Active: active (running) since Mon 2022-04-11 17:51:50 CST; 1 day 16h ago
     Docs: https://www.elastic.co/products/beats/filebeat
 Main PID: 18184 (filebeat)
   CGroup: /system.slice/filebeat.service
           └─18184 /usr/share/filebeat/bin/filebeat --environment systemd -c /etc/filebeat/filebeat.yml --path.home /usr/share/filebeat --path.config /etc/filebeat --path.data /var/lib/filebeat --path.logs /var/log/filebe...

Apr 13 10:42:50 www.yoyi.com.cnjs filebeat[18184]: 2022-04-13T10:42:50.565+0800        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu...
Apr 13 10:43:20 www.yoyi.com.cnjs filebeat[18184]: 2022-04-13T10:43:20.565+0800        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu...
Apr 13 10:43:50 www.yoyi.com.cnjs filebeat[18184]: 2022-04-13T10:43:50.565+0800        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu...
Apr 13 10:44:20 www.yoyi.com.cnjs filebeat[18184]: 2022-04-13T10:44:20.565+0800        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu...
Apr 13 10:44:50 www.yoyi.com.cnjs filebeat[18184]: 2022-04-13T10:44:50.566+0800        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu...
Apr 13 10:45:20 www.yoyi.com.cnjs filebeat[18184]: 2022-04-13T10:45:20.565+0800        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu...
Apr 13 10:45:50 www.yoyi.com.cnjs filebeat[18184]: 2022-04-13T10:45:50.565+0800        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu...
Apr 13 10:46:20 www.yoyi.com.cnjs filebeat[18184]: 2022-04-13T10:46:20.565+0800        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu...
Apr 13 10:46:50 www.yoyi.com.cnjs filebeat[18184]: 2022-04-13T10:46:50.566+0800        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu...
Apr 13 10:47:20 www.yoyi.com.cnjs filebeat[18184]: 2022-04-13T10:47:20.566+0800        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu...
Hint: Some lines were ellipsized, use -l to show in full.

六、查看信息

[root@elk ~]# docker exec -it redis /bin/bash
root@4dc403347141:/data# redis-cli 
127.0.0.1:6379> auth Re123dis
OK
127.0.0.1:6379> select 4
OK
127.0.0.1:6379[4]> keys *
1) "nginx-web"